ios-forensics

Open-source desktop workbench for digital forensic analysis. Inspect ZIP/TAR/7z/UFDR archives, raw disk images/EWF, and iTunes/Android backups. Parse and view ABX, SQLite, SEGB, (B)PLIST, REALM, Protobuf, MMKV, Logs, hex, JSON, XML, images, audio/video, PDF, and more — all in one GUI.

Forensic extraction for WhatsApp, Signal, and Telegram — 8-layer SQLite recovery, anti-forensics detection, court-ready reports.

Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.

The all-in-one iOS workbench for macOS: mount DDIs, run pymobiledevice3/DVT diagnostics, stream Unified Logs, capture PCAPs, simulate GPX locations, inspect and sideload IPAs, inventory apps, create encrypted backups, and collect forensic evidence.

Open-source iOS forensic workstation & zero-day research platform: 77 public exploit routes, 36 CVEs, own BFU decryption stack, DFU fuzzing campaign, court-ready chain of custody - the honest Cellebrite-class alternative

Useful tools for (not only) digital forensics

An open-source forensic parser for Apple Intelligence Report JSON files.

Three mobile forensics examinations: iOS full filesystem analysis (Cellebrite), legacy mobile device artifact recovery (Autopsy/FTK), and Android APK static & dynamic analysis (JADX/PCAPdroid).

Lightweight Python-based PCAP analyzer with persistent state tracking and DNS entropy inspection for forensic and security investigations.

Extract Wispr Flow iPhone transcripts from local iPhone backups, with Phosphor-friendly one-command export and raw SEGB provenance

Lightweight forensic support tool for processing extracted iOS WhatsApp ChatStorage.sqlite databases into CSV and HTML timeline outputs.

A modern toolchain for booting custom kernels on pre-A7 iOS devices (iPhone 3GS, iPod touch 3, iPad 1). Modern-clang cross-compile pipeline for iOS 5 armv7 binaries, an offline kernelcache patcher, and a forgotten-PIN data recovery walkthrough.

Digital forensic investigation case study involving cross-device analysis (iOS & Windows), email artifact examination, metadata timeline reconstruction and incident threat assessment. All identifying data anonymized.

iOS Developer Toolkit (Swift): a native macOS app and CLI for iPhone, iPad, and simulators — device info, live logs, packet and Bluetooth capture, developer image mounting, GPX location simulation, IPA install, encrypted backups, hashed evidence. The Python app is hideouts-io/iOS-Developer-Toolkit.

Restructure the iOS backup directory from GUID directories to human-readable